Data Privacy Policy

Seckford Care is registered with the Care Quality Commission to provide regulated care in our Care Home. We provide person-centred care and support in our Extra Care apartments and Residential Care Home in Jubilee House.

We are committed to protecting and respecting your privacy and all personal information obtained to meet our regulatory requirements will always be treated in line with our explicit consent, data protection and confidentiality policies.

This privacy notice sets out the basis on which any personal and special category data that we collect from you, or that you provide to us, will be processed and stored by us. It is required by law and tells you about your rights and our obligations regarding our collecting and processing of any of your personal information, which you might provide to us.

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. This applies to all data, regardless of whether it is in paper or electronic format.

Your privacy is important to us

This notice informs you how we use the information you give us and how we protect your privacy. It also explains your rights under the relevant “Data Protection Law”, supporting legislation and regulatory frameworks relating to the personal information you supply. These include but are not limited to:

• The UK General Data Protection Regulations;
• The Data Protection Act 2018;
• The Data (Use and Access) Act 2025;
• The Privacy and Electronic Communications Regulations 2003 (PECR); and
• The Protection of Freedoms Act 2012 (biometrics and CCTV).

We abide by UK Law and take reasonable care to comply with the requirements of the relevant legislation and guidance published by our data protection regulator within the UK which is the Information Commissioner’s Office – ICO – whose contact details are below.

Roles and Responsibilities

Seckford Care is part of The Seckford Foundation, a company registered in England and Wales. Our company registration number is 05522615. The Foundation is also a Charitable Company limited by guarantee (No: 1110964) and our registered office is Marryott House, Burkitt Road, Woodbridge, Suffolk, IP12 4JJ. The Governing Board has overall responsibility for ensuring that Seckford Care complies with its obligations. Day to day responsibilities rest with the Head of Care or their Deputy and they ensure that all staff are aware of their data protection obligations.

For the purposes of the relevant legislation (“data protection law”) the data controller is The Seckford Foundation and is the registered as the data controller with the Information Commissioner’s Office (ICO).

Seckford Care (through The Seckford Foundation) has appointed the Director of Operations as Data Protection Officer (DPO) who will deal with your requests and enquiries concerning the processing of your personal data and endeavour to ensure that all personal data is processed in compliance with this notice and data protection law.

Any questions, comments or requests regarding this Privacy Notice are welcomed. Should you wish to contact us in relation to any issues within this notice, make a request for information or exercise “Your rights” under Data Protection legislation, feel that we have mishandled your data at any time, or in relation to the storing or processing of your personal and/or special category data, please contact the DPO using these details:

Richard Stone

Director of Operations

The Seckford Foundation

Marryott House

Woodbridge, Suffolk IP12 4JJ

Tel: 01394 615000

Collecting of, and purpose for, your information

We offer services and products to our clients. To provide these, and as a registered care provider, we may need to collect personal data, such as:

• Name, address and contact details including for next of kin.
• Financial information, including bank account information to enable payment of services.
• Transaction data, including details of payments from you for the services that we have provided.
• Information about your life, including social history, health and wellbeing, treatment and care.
• Notes and reports about your health and care provision, including medical records and medication provided.
• Compliments, complaints, accidents and incidents information.

This information is essential to our being able to provide effective care and support.

We use information held about you in the following ways:

• Your information may be used to introduce you to the services that we offer, to help with ongoing administration, to contact you with any review or changes that are applicable, and/or for our own business research and analysis.
• To ensure that content from our site is presented in the most effective manner for you and for your computer.
• To provide you with information, products or services that you request from us, or which we feel may interest you, where you have consented to be contacted for such purposes.
• To carry out our obligations arising from any contracts entered into between you and us.
• To allow you to participate in interactive features of our service, when you choose to do so.
• To notify you about changes to our service.

Withholding of the required data may result in an insufficient service being provided.

We may obtain data from individual customers or from employer firms.

Lawful basis for processing

By law, we need to have a lawful basis for processing your personal data.

Data is processed because:

• We are required to do so in order to fulfil a contract that we have with you.
• We have a legal obligation to do so.
• It is necessary for the purposes of the legitimate interests pursued by us or by a third party to process your information. We can do that so long as we do not interfere with your fundamental rights or freedoms. This may include making use of photographic images and video content of residents Seckford Care publications, on the Seckford Care and Foundation websites and (where appropriate) on social media channels in accordance with the relevant Seckford Care and Seckford Foundation policies.
• For Security purposes, including CCTV, in accordance with the Seckford Foundation CCTV Policy (which may include images and sound).

Special Category Data

Some personal information is treated as more sensitive (for example information about health, sexuality, ethnic background and others – see note below for a full list). The legal basis for processing these special categories of personal information is more limited. To lawfully process special categories of personal data, we must identify a lawful basis for the processing and meet a separate condition for the processing.

We process your special category data because:

• It is necessary for us to provide and manage social care services.
• It is necessary due to social security and social protection law.
• You have provided your consent. We will request permission and will offer you a clear choice and ask that you confirm to us that you consent.
• Where we need to protect the vital interests (i.e. the health and safety) of you or another person and you are incapable of giving consent.

Special categories of personal data is defined within the UK GDPR and covers racial or ethnic origin, political opinions, religious or philosophical beliefs or beliefs of a similar nature, or trade union membership, genetic data, biometric data where used for identification purposes, data concerning physical and mental health or data concerning a person’s sex life or sexual orientation, or whether a person has committed, or is alleged to have committed, an offence. This does not include personal data about criminal allegations, proceedings of convictions, as separate rules apply.

Sharing your data

We may share your personal data with the following organisations:

• We may verify your identity by searching publicly available records held by credit reference agencies.
• Business partners, suppliers and sub-contractors for the performance of any contract that we enter into with them.
• Other parts of the health and social care system such as local hospitals, the GP, the pharmacy, social workers, clinical commissioning groups, other health and care professionals and other third parties for medical reasons.
• The Local Authority.
• Organisations with whom we have a legal obligation to share information, for example: for medical reasons, and, for safeguarding, the Care Quality Commission.
• The Police or other law enforcement agencies, if we have to by law or court order.
• Relevant stages of the Seckford Foundation Data Protection Complaints Policy which may include someone external to Seckford Care or the Foundation with expert data protection knowledge.

We will not sell or share your information with any other third parties, unless we have obtained additional consent from you or where there is another lawful basis available to us.

At this time, we do not share any data for planning or research purposes for which the national data opt-out would apply.

How we manage your personal information

We process your personal information in accordance with the principles of UK GDPR and all relevant “Data Protection Law”.

We will treat your personal information fairly and lawfully and we will ensure that information is:

• Processed for limited purposes;
• Kept up-to-date, accurate, relevant and not excessive;
• Not kept longer than is necessary;
• Kept secure.

Access to personal information is restricted to authorised individuals on a strictly ‘need to know’ basis.

We are committed to keeping your personal details as up to date and accurate as possible, and we encourage you to inform us about any changes needed to ensure your details are accurate. Please do this by contacting the Seckford Care Office enquiries@seckfordcare.org.uk

Your rights regarding your data

• Should your data be inaccurate, we will rectify this without delay.
• Should you wish us to delete your data at any point, please contact the Office, as shown further below, to make the request. This will be actioned, unless there is a lawful basis for us to retain the information; in which case, you will be advised accordingly.
• You can request access to your data at any time. We will provide you with a full copy within one month of your request, unless the request is complex or repeated, in which case the deadline may be extended by a further two months.
• You can withdraw consent to us holding and processing your information at any time.
• Object, on grounds relating to your particular situation, to any of our processing activities where you feel this has a disproportionate impact on your rights.
• We may provide you with updates and bulletins, which are appropriate to your service, on an ongoing basis – this will be explained to you, if it is applicable. You can opt out of these, should you wish to – please contact us and advise us, if you wish to.
• If we are processing your data as part of our legitimate interests, you have the right to object to that processing. We will restrict all processing of this data, while your objection is investigated.

Any request to exercise your rights should be made to the DPO. You are not normally required to pay any charge for exercising your rights. If you make a request, we normally have one month to respond to you.

Should you wish to transfer your data to another organisation, please contact the Seckford Care Office enquiries@seckfordcare.org.uk and we will organise this for you.

Data Storage and Security

We have a range of policies and procedures in place to ensure that any personal information you supply will always be held securely and treated confidentially in line with the applicable regulations and requirements. These include a full Data Protection Policy, Cyber Security Policy and Acceptable Use Policy, and business continuity plan.

Where we store your personal data:

The data that we collect from you may be transferred to, and stored at, a destination outside the UK. It may also be processed by staff operating outside the UK, who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy notice and the relevant “Data Protection Law”.

Paper based records, digital records and portable electronic devices, such as laptops and hard drives that contain personal information all comply to the relevant “Data Protection Law”.

How long we keep information

There are strict requirements in place to determine how long the organisation will keep information, which are in line with the relevant legislation and regulations. Your data will be subject to retention, archiving and destruction in accordance with the Seckford Foundation Data Retention Schedule which is aligned to the relevant data protection. Law. A copy of this retention schedule is available on request.

Changes to Privacy Notice

Our Privacy Notice may change from time to time. In this case, the amended version will be published on the Care website and made available in other formats as required. Details of when this Notice was last updated can be found in the footer.

Queries and Complaints

If you believe that Seckford Care has not complied with this Privacy Notice or acted otherwise than in accordance with data protection law, you should contact the DPO Richard Stone whose details are given above with details of your complaint. Your complaint will be acknowledged within 30 days of receipt and we will investigate and inform you of the outcome of your complaint without undue delay (keeping you informed of progress as necessary).

The Seckford Foundation Data Protection Complaints Policy gives further details and is available on request by contacting the DPO contact details above.

Your right to Complain to the ICO at any time

You can complain to the ICO Information Commissioner’s Office (ICO) at any point. You do not need to wait for the Seckford Care to review its decision at any stage before complaining to the ICO. The ICO contact details are:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

The ICO can only deal with complaints on Data Protection issues. They cannot advise on aspects that relate to other legislative or regulatory frameworks.

Further Resources and information

• Google Privacy and Terms Policy
• ICO Guidance